job4: SPEC-12 deploy-commit exit taxonomy

lib/deploy-commit.sh: a rejected `git commit` (pre-commit hook,
protected branch, signing failure) now exits 6 (loud stderr, distinct
from rc 1's "nothing to do") instead of sharing rc 1 with the no-op
cases. Header comment documents the full 0/1/2/3/4/5/6 taxonomy.
Closes J4-22 (UNTESTABLE): at client repos, a failed deploy-state
commit was indistinguishable BY EXIT CODE from "nothing to do" (rc 1
was shared 3 ways); exit-code-only callers couldn't disambiguate
(stderr-parsing callers already could).

Caller census (per report's explicit gate): skills/deploy/SKILL.md
documents and parses this exit-code contract in TWO places (bootstrap
commit + incident-recovery commit). Flagged to the user before
committing; confirmed GO to add rc 6 there too (additive — no existing
code's meaning changes) so the documented contract stays accurate for
live deploy runs.

New T10 in lib/tests/deploy-commit.test.sh (+3 assertions, 13→16):
rejecting pre-commit hook sandbox — asserts rc 6, empty stdout (no
stale hash), HEAD unmoved.

GREEN: full `make test` exit 0 (deploy-commit 16/16 incl. T10).
shellcheck clean, bash -n clean.

skills/deploy/SKILL.md

@@ -250,6 +250,7 @@ Present the full draft `PROCEDURE.md`.
    Return codes: **0** committed · **1** no-op (investigate — both files should be new) ·
    **3** unsafe git state (STOP, tell user) · **4** out-of-scope path ·
    **5** a passed path is git-ignored (won't persist) — STOP, fix the target's `.gitignore` ·
+   **6** commit rejected — pre-commit hook/protected branch/signing (STOP, investigate) ·
    **2** usage error OR not a git repo.
 
 **On rc=0: continue to STEP 1.** `STATE.json` absent → first deploy →
@@ -358,8 +359,9 @@ Return codes: **0** committed (short-hash on stdout) · **1** nothing staged —
 wrote neither file · **3** unsafe git state (detached/merge/rebase — STOP, tell
 the user) · **4** out-of-scope path (you passed a non-`.claude/deploy/` path — fix
 the call) · **5** a passed path is git-ignored (won't persist) — STOP, fix the
-target's `.gitignore` · **2** usage error OR not a git repo. The helper commits
-whatever subset actually changed;
+target's `.gitignore` · **6** commit rejected — pre-commit hook/protected branch/
+signing (STOP, investigate) · **2** usage error OR not a git repo. The helper
+commits whatever subset actually changed;
 patch+incident coupling is **Claude-discipline, not helper-enforced**.
 
 **This commit IS the resolution** — the commit that introduces `DEP-NNN` is its